Risk identification model training method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a training method and device of a transaction risk identification model, electronic equipment and a storage medium, and relates to the technical field of artificial intelligence. Comprising the steps of obtaining a plurality of event sequences in a financial transaction process; labeling risk tags for risk event sequences in the event sequences according to preset risk business rules to obtain the risk event sequences; inputting the unlabeled event sequence into a to-be-trained auto-encoder neural network for training to obtain a trained auto-encoder neural network, and adding a full connection layer to the trained auto-encoder neural network to form a first recognition model; and inputting the risk event sequence into the first identification model for training to obtain a trained second identification model. By adopting the technical scheme, the workload of manual label labeling can be greatly reduced on the basis of ensuring the accuracy of the risk identification model.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence technology, and in particular to a training method, device, electronic device and storage medium for a risk identification model. Background Art

[0002] With the development of network technology, online financial transactions through network technology such as blockchain technology are becoming more and more common, and the risk identification of corresponding financial transactions is becoming more and more important.

[0003] Although there are technical solutions for identifying transaction risks through training models in related technologies, there are some technical problems with the transaction risk identification models in related technologies.

[0004] On the one hand, the training of the transaction risk identification model requires a large amount of labeled data, and manual labeling is time-consuming and laborious. On the other hand, the accuracy of the transaction risk identification model needs to be improved. For example, the model may encounter abnormal transaction types that cannot be resolved. For example, when the identity of the remitter or victim in a transaction is a senior or special customer in the data of a credit rating agency, any transaction risk method based on machine learning or manual analysis cannot easily reject the transaction, which will lead to potential risks in the transaction process. For another example, senior or special customers may rarely file a complaint even if the transaction is rejected during the transaction process. The transaction risk identification model cannot learn the corresponding features in time, which also affects the accuracy of the model. Summary of the invention

[0005] The purpose of the embodiments of the present disclosure is to provide a training method, device, electronic device and storage medium for a transaction risk identification model.

[0006] To solve the above technical problems, the embodiments of the present disclosure are implemented through the following aspects.

[0007] According to a first aspect of an embodiment of the present disclosure, a method for training a transaction risk identification model is provided, the method comprising: Acquire multiple event sequences in a financial transaction process, wherein the event sequences include event type, event occurrence time, and event subject; According to a preset risk business rule, a risk tag is marked for a risk event sequence in the multiple event sequences to obtain a risk event sequence; Inputting the unlabeled event sequence into the autoencoder neural network to be trained for training to obtain a trained autoencoder neural network, and adding a fully connected layer to the trained autoencoder neural network to form a first recognition model, wherein the unlabeled event sequence is other event sequences among the multiple event sequences except the risk event sequence; The risk event sequence is input into the first recognition model for training to obtain a trained second recognition model.

[0008] According to a second aspect of an embodiment of the present disclosure, there is provided a training device for a transaction risk identification model, the device comprising: an acquisition module, for acquiring a plurality of event sequences in a financial transaction process, the event sequences comprising event type, event occurrence time and event subject; A labeling module, used for labeling risk labels for risk event sequences in the multiple event sequences according to preset risk business rules to obtain risk event sequences; A first training module is used to input an unlabeled event sequence into an autoencoder neural network to be trained to obtain a trained autoencoder neural network, and add a fully connected layer to the trained autoencoder neural network to form a first recognition model, wherein the unlabeled event sequence is other event sequences among the multiple event sequences except the risk event sequence; The second training module is used to input the risk event sequence into the first recognition model for training to obtain a trained second recognition model.

[0009] According to a third aspect of an embodiment of the present disclosure, there is provided an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is used to execute the steps of the method for training a transaction risk identification model described in the first aspect above.

[0010] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, which stores one or more programs. When the one or more programs are executed by an electronic device including multiple applications, the electronic device executes the steps of the training method of the transaction risk identification model described in the first aspect.

[0011] One of the above technical solutions has the following advantages or beneficial effects. It can automatically label risk labels for risk event sequences in event sequences for preset risk business rules. At the same time, a preliminary recognition model is constructed based on the training of the autoencoder neural network through unlabeled event sequences, and the preliminary recognition model is trained through automatically labeled labels to obtain a trained recognition model. This can greatly reduce the workload of manual labeling while ensuring the accuracy of the risk identification model.

[0012] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure.

[0013] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0015] Figure 1 A flow chart showing a method for training a transaction risk identification model provided by an embodiment of the present disclosure; Figure 2 Another flow chart of a method for training a transaction risk identification model provided by an embodiment of the present disclosure is shown; Figure 3 Another flowchart of the training method of the transaction risk identification model provided by the embodiment of the present disclosure is shown; Figure 4 Another flowchart of the training method of the transaction risk identification model provided by the embodiment of the present disclosure is shown; Figure 5 Another flowchart of the training method of the transaction risk identification model provided by the embodiment of the present disclosure is shown; Figure 6 A block diagram of a training device for a transaction risk identification model provided by an embodiment of the present application is shown; Figure 7 A block diagram showing another training device for a transaction risk identification model provided by an embodiment of the present application; Figure 8 A schematic diagram of the hardware structure of an electronic device for executing the training method of the transaction risk identification model provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0016] In order to enable those skilled in the art to better understand the technical solutions in the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present disclosure.

[0017] It should be noted that the transactions in this application can be financial transactions implemented based on network technology, such as data trust transactions based on blockchain technology, or online transfers, online shopping and other transactions based on the Internet. This application does not limit the specific types of financial transactions.

[0018] Figure 1 A flow chart showing a method for training a transaction risk identification model provided by an embodiment of the present disclosure is shown as follows: Figure 1 As shown, the method may include the following steps: In step S101, multiple event sequences in a financial transaction process are obtained.

[0019] The event sequence includes event type, event occurrence time and event subject.

[0020] Taking data trust transactions based on blockchain technology as an example, in the financial technology industry, blockchain stores data scattered in a distributed architecture in a chain to form an open and transparent record. Each record block is sorted according to the event sequence, and multiple record blocks together form a public account book. The public account book data comes from financial transaction events in the node. The node is a hardware terminal with financial transaction authority and node information in the financial information blockchain. Each node corresponds to a different financial transaction subsystem. The event data that occurred on different nodes in the original financial transaction process can be obtained. For the same event subject, the events on different nodes can be arranged in chronological order to obtain the event sequence.

[0021] An event sequence is a collection of events arranged in chronological order. Events can refer to various behaviors, operations or state changes that occur during a transaction, such as user login, transaction initiation, transaction confirmation, etc.

[0022] In some embodiments, the event sequence may include the event type, the time of occurrence of the event, and the event subject, where the event subject may be a user, account, or other entity involved in the event. The event sequence may further include an event identifier and additional event information, where the event identifier is used to uniquely identify an event, and the event additional information is used to record other information related to the event, such as the transaction amount and transaction location.

[0023] In practical applications, event sequences can be stored in the form of data structures (such as lists, arrays) or database tables, with each event being an element in the data structure or a row in the database table.

[0024] For example, the following table 1 shows the original data obtained from the node.

[0025]

[0026] Table 1 According to the original data obtained from the node in Table 1, an event sequence corresponding to the original data can be further obtained as follows: Event 1: Event ID: E001 Event Type: User login Event time: 2023-04-01 10:00:01 Event Subject: User ID 001 Additional event information: None Event 2: Event ID: E002 Event type: transaction initiated Event time: 2023-04-01 10:05:30 Event Subject: User ID 001 Additional event information: transaction amount 1000 Event 3: Event ID: E003 Event Type: Transaction Confirmation Event time: 2023-04-01 10:06:00 Event Subject: User ID 001 Additional event information: transaction amount 1000 Through the above steps, the original data is converted into a series of events arranged in chronological order. Each event contains necessary information, such as event type, event time, event subject, and can further include additional event information and corresponding event identifiers. These event sequences can be used as input data for subsequent risk identification models for training and optimization.

[0027] In step S102, risk tags are marked for risk event sequences in multiple event sequences according to preset risk business rules to obtain risk event sequences.

[0028] In some embodiments, the event sequence can be analyzed by preset risk business rules to identify the risk factors contained therein, identify the corresponding risk event sequence, and annotate the risk event sequence in multiple event sequences with risk tags.

[0029] For example, an account with a low credit rating but abnormally active trading activities is a typical risk factor. The preset risk business rule may be "the account's credit rating is less than the credit threshold, and the number of transactions in any preset time period exceeds the quantity threshold". When the same account meets the preset risk business rule in multiple event sequences, one or more event sequences corresponding to the account are regarded as risk event sequences, and risk labels are marked for the risk event sequences.

[0030] In some embodiments, preset risk business rules may be classified according to risk levels, thereby labeling risk event sequences with risk tags of different levels. Figure 2Another flow chart of the training method of the transaction risk identification model provided by the embodiment of the present disclosure is shown as follows: Figure 2 As shown, step S102 may include the following steps.

[0031] In step S1021, the event sequence satisfying the first risk business rule is marked with a high-risk label.

[0032] In step S1022, the event sequence satisfying the second risk business rule is marked with a common risk label.

[0033] The preset risk business rules may include a first risk business rule and a second risk business rule, and the risk level of the event sequence corresponding to the first risk business rule is higher than the risk level of the event sequence corresponding to the second risk business rule.

[0034] In some embodiments, the event subject can be divided into primary objects and secondary objects according to the risk level. The primary object is the core entity directly related to the high-risk behavior, such as the account with a low credit rating but abnormally active trading activities in the above example. The secondary object is an entity with a lower risk level but some association with the primary object, or an entity with certain risks itself, such as an entity that has conducted transactions with the primary object.

[0035] Correspondingly, the preset risk business rules can be divided into first risk business rules and second risk business rules. The event sequence that meets the first risk business rule is regarded as a high-risk event sequence, and the high-risk event sequence is marked with a high-risk label. The event sequence that meets the first risk business rule is regarded as a normal risk event sequence, and the normal risk event sequence is marked with a normal risk label.

[0036] In some embodiments, the high-risk label may also be specifically "fraud risk", and the ordinary risk label may also be specifically "risk of suspected abnormal transaction".

[0037] In step S1023, other event sequences in the event sequence except those marked with high-risk labels and ordinary risk labels are regarded as unlabeled event sequences.

[0038] In step S103, the unlabeled event sequence is input into the autoencoder neural network to be trained to obtain a trained autoencoder neural network, and a fully connected layer is added to the trained autoencoder neural network to form a first recognition model.

[0039] Among them, the unlabeled event sequences are other event sequences except the risk event sequences among the multiple event sequences.

[0040] The autoencoder neural network can include an encoder and a decoder. By restricting the information flow between the encoder and the decoder, the model can learn a compact representation of the input data. The encoder converts the input data into a representation of the latent space through layer-by-layer processing. This representation usually has a higher level of abstract features than the original data. The decoder converts the representation of the latent space back to the original input space through the reverse operation, thereby reconstructing the data.

[0041] In some embodiments, an unlabeled event sequence can be input into the autoencoder neural network to be trained, with the goal of minimizing the reconstruction error of the autoencoder neural network to be trained, and the parameters of the autoencoder neural network to be trained can be iteratively optimized through a back-propagation algorithm until a preset number of iterations is reached or the reconstruction error is less than a preset threshold, thereby obtaining a trained autoencoder neural network.

[0042] It can be understood that in the present application, inputting the event sequence into the neural network model means performing corresponding feature transformation or extraction on the event sequence, and inputting the transformed or extracted event sequence features into the neural network model.

[0043] After obtaining the trained autoencoder neural network, a fully connected layer can be added to the trained autoencoder neural network to form a first recognition model, so that the first recognition model can obtain the output result corresponding to the unlabeled event sequence through the corresponding activation function.

[0044] In step S104, the risk event sequence is input into the first recognition model for training to obtain a trained second recognition model.

[0045] After the first recognition model is obtained, the risk event sequence can be input into the first recognition model for training through the following steps to obtain the second recognition model.

[0046] In step 10, the risk event sequence is input into the first identification model to obtain the output result of the first identification model. In this process, the data will pass through each layer of the neural network in turn, and each layer will calculate the output of the layer based on the current weight and input data.

[0047] In step 11, the loss value between the output result and the label of the risk event sequence is calculated, and the gradient of each model parameter in each first recognition model is calculated by the back propagation algorithm. The gradient represents the sensitivity of the loss value to the model parameter, that is, how a small change in the model parameter affects the loss value.

[0048] In step 12, based on the calculated gradient, an optimization algorithm (such as gradient descent algorithm, Adam algorithm) is used to update the value of each model parameter. The purpose of the update is to reduce the loss value between the output result and the label of the risk event sequence.

[0049] In step 13, steps 10 to 13 are repeated until a preset training termination condition is reached. For example, the training termination condition may be reaching a preset number of training rounds or the loss value being less than a preset loss value threshold.

[0050] The above technical solution can significantly reduce the workload of manual labeling while ensuring the accuracy of the risk identification model.

[0051] Figure 3 Another flow chart of the training method of the transaction risk identification model provided by the embodiment of the present disclosure is shown as follows: Figure 3 As shown, the method may further include the following steps.

[0052] In step S105, in response to the user's labeling operation on the unlabeled event sequence or the label update operation on the risk event sequence, an updated labeled event sequence is obtained.

[0053] In some embodiments, the user can manually annotate the unlabeled time series, so that the manually annotated event sequence can also manually correct the possible erroneous annotations for the risk event sequence obtained according to the preset risk business rules. The event sequence with the manually added annotations, the modified and corrected risk event sequence, and the original risk event sequence (i.e., the event sequence in the risk event sequence that has not been manually corrected) can be used as the updated annotated event sequence to optimize the second recognition model.

[0054] In step S106, the updated labeled event sequence is input into the second recognition model, and the second recognition model is trained to obtain an updated second recognition model.

[0055] In some possible implementations, specific steps for optimizing the training of the second recognition model refer to steps 10-13, which will not be elaborated here.

[0056] By adopting the above technical solution, it is possible to obtain a labeled event sequence by combining automatic labeling and manual labeling. Through the updated labeled event sequence, the second recognition model can have the ability to learn from expert experience, further improving the accuracy of the risk identification model.

[0057] Figure 4 Another flow chart of the training method of the transaction risk identification model provided by the embodiment of the present disclosure is shown as follows: Figure 4 As shown, the method may further include the following steps.

[0058] In step S107, the event sequence whose output results are different from the corresponding labels during the training process of the second recognition model is taken as an abnormal event sequence set.

[0059] In some embodiments, event sequences that cannot be correctly recognized by the second recognition model in training are taken as abnormal event sequence sets.

[0060] In step S108, the abnormal event sequence with the highest label frequency is screened from the abnormal event sequence set to obtain an abnormal event sequence subset.

[0061] In some possible implementations, a set of event sequences whose label occurrence frequencies corresponding to the abnormal event sequence set exceed a preset frequency threshold (for example, 60%) may be taken as an abnormal event sequence subset.

[0062] For example, the abnormal event sequence set has a total of 100 event sequences, and the number of event sequences labeled as “high risk” is 73. Then, the 73 event sequences can be used as the abnormal event sequence subset corresponding to the label “high risk”.

[0063] In step S109, the connection degrees between each of the abnormal event sequences in the abnormal event sequence subset are calculated, and the corresponding labels are updated according to at least one connection degree corresponding to the abnormal event sequence.

[0064] Among them, the degree of connection represents the temporal correlation and attribute similarity between the corresponding two abnormal event sequences. Attribute similarity can also be called attribute weight, which is used to measure the similarity of the features between two event sequences. The temporal correlation is used to measure the correlation between two event sequences in the event dimension.

[0065] In some embodiments, the attribute similarity between any two event sequences may be determined by the following formula 1.

[0066] (Formula 1) in, is the attribute similarity, is the preset value corresponding to the common label (i.e., the label corresponding to the subset of abnormal event sequences). For example, when the common label is a high-risk label, It can be 0.7. When the commonly used label is a common risk label, Can be 1, and are the probabilities that the event sequences obtained by the second recognition model for the two event sequences belong to the common labels.

[0067] For example, suppose that the risk labels of event sequence A and event sequence B are both common risk labels, and the risk labels of event sequence A are = 0.6, event sequence B corresponds to =0.8, then the attribute similarity is 0.48.

[0068] The temporal correlation between any two event sequences can be determined by the following formula 2.

[0069] (Formula 2) in, is the temporal correlation, is the time difference between two event sequences, is the time difference between the latest event sequence and the earliest event sequence in the abnormal event sequence subset, is the time difference between the later event sequence and the earliest event sequence in the two event sequences, is the preset adjustment parameter, for example 0.8.

[0070] Assume that the abnormal event sequence subset includes event sequence A, event sequence B, event sequence C and event sequence D. The times when event sequence A, event sequence B and event sequence C occur are t0=2022-12-31, t1=2023-01-01, t2=2023-01-10 and t3=2023-01-30 respectively.

[0071] The temporal correlation between event sequence B and event sequence C can be calculated as follows.

[0072] but = t3- t0=30 days, = 10 days, =9 days, Substituting the above values ​​into formula 2, we can get =2.4.

[0073] In some embodiments, for the same event sequence, multiple correlation degrees corresponding to the event sequence can be obtained by respectively calculating the correlation degrees with other event sequences in the abnormal event sequence subset, and the maximum value of the multiple correlation degrees corresponding to the event sequence can be used as the final correlation degree corresponding to the event sequence.

[0074] In some embodiments, the degree of connection is the product of the temporal correlation and the attribute similarity. Figure 5 Another flow chart of the training method of the transaction risk identification model provided by the embodiment of the present disclosure is shown as follows: Figure 5 As shown, step S109 may specifically include the following steps.

[0075] In step S1091, a first probability of a risk event output by a second recognition model of the abnormal event sequence before updating is obtained.

[0076] For example, the first probability of a risk event output by the second recognition model of the abnormal event sequence before updating is 0.71, and the threshold of the second recognition model when making risk identification judgments is assumed to be 0.8. Since the first probability is less than the threshold, the result output by the second recognition model is a normal risk label.

[0077] In step S1092, the product of the degree of connection and the first probability is taken as the second probability.

[0078] For example, the connection degree of the abnormal event sequence is 0.48 2.4=1.152, the product of the connection degree and the first probability 0.71 gives the second probability of 1.152 0.71=0.82.

[0079] In step S1093, an updated label corresponding to the abnormal event sequence is determined according to the second probability and a preset threshold in the second recognition model before updating.

[0080] After the second probability is obtained, based on the second probability 0.82 and the corresponding threshold 0.8, since the second probability is greater than the threshold, the updated label corresponding to the abnormal event sequence is a high-risk label.

[0081] It is understandable that the value of the degree of connection can be greater than 1 or less than 1, so the second probability can be greater than the first probability or less than the first probability. Correspondingly, the label determined according to the second probability and the preset threshold in the second recognition model before the update can be the same as the result output by the second recognition model before the update, or it can be different from the result output by the second recognition model before the update.

[0082] In step S110, the abnormal event sequence with updated labels is input into the second recognition model, and the second recognition model is trained to obtain an updated second recognition model.

[0083] In some possible implementations, specific steps for optimizing the training of the second recognition model refer to steps 10-13, which will not be elaborated here.

[0084] By adopting the above technical solution, it is possible to calculate the frequency and connection of data in the abnormal event sequence set, extract the highly correlated set, and use the highly correlated set to adjust and optimize the identification model, thereby further improving the accuracy of the risk identification model.

[0085] It should be noted that Figure 3 and Figure 4 The steps shown can be performed alternately and iteratively. Figure 1 The steps shown can also be performed in real time after obtaining the latest sequence of events. Figure 3 and\or Figure 4The steps shown are iterated together to obtain financial transaction information in real time and dynamically adjust the optimization model.

[0086] Figure 6 A block diagram of a training device for a transaction risk identification model provided by an embodiment of the present application is shown. Figure 6 As shown, the training device 100 for the transaction risk identification model includes: The acquisition module 110 is used to acquire multiple event sequences in the financial transaction process, where the event sequence includes event type, event occurrence time and event subject.

[0087] The labeling module 120 is used to label risk tags for risk event sequences in multiple event sequences according to preset risk business rules to obtain risk event sequences.

[0088] The first training module 130 is used to input the unlabeled event sequence into the autoencoder neural network to be trained for training, obtain the trained autoencoder neural network, and add a fully connected layer to the trained autoencoder neural network to form a first recognition model. The unlabeled event sequence is other event sequences in multiple event sequences except the risk event sequence.

[0089] The second training module 140 is used to input the risk event sequence into the first recognition model for training to obtain a trained second recognition model.

[0090] Optionally, the preset risk business rule includes a first risk business rule and a second risk business rule, the risk level of the event sequence corresponding to the first risk business rule is higher than the risk level of the event sequence corresponding to the second risk business rule, and a risk tag is marked for a risk event sequence in the multiple event sequences according to the preset risk business rule. The marking module 120 is further used to: The event sequence that meets the first risk business rule is marked with a high-risk label.

[0091] The event sequence that meets the second risk business rule is marked with a common risk label.

[0092] The event sequences other than those marked with high-risk labels and ordinary risk labels are regarded as unlabeled event sequences.

[0093] Optionally, the first training module 130 is further configured to: The unlabeled event sequence is input into the autoencoder neural network to be trained, with the goal of minimizing the reconstruction error of the autoencoder neural network to be trained. The parameters of the autoencoder neural network to be trained are iteratively optimized through the back propagation algorithm until the preset number of iterations is reached or the reconstruction error is less than the preset threshold, thereby obtaining a trained autoencoder neural network.

[0094] The device 100 provided in the embodiment of the present application can execute each method in the foregoing method embodiment and realize the functions and beneficial effects of each method in the foregoing method embodiment, which will not be described in detail here.

[0095] Figure 7 A block diagram of a training device for a transaction risk identification model provided by an embodiment of the present application is shown. Figure 7 As shown, the training device 100 for the transaction risk identification model further includes an optimization module 150 for: In response to a user's labeling operation on an unlabeled event sequence or a label update operation on a risk event sequence, an updated labeled event sequence is obtained; The updated labeled event sequence is input into the second recognition model, and the second recognition model is trained to obtain an updated second recognition model.

[0096] Optionally, the optimization module 150 is further configured to: The event sequence whose output result during the training process of the second recognition model is different from the corresponding label is taken as an abnormal event sequence set; Filter the abnormal event sequence with the highest label frequency from the abnormal event sequence set to obtain the abnormal event sequence subset; Calculate the connection degree between each of the abnormal event sequences in the abnormal event sequence subset, and update the corresponding label according to at least one connection degree corresponding to the abnormal event sequence, where the connection degree represents the temporal correlation and attribute similarity between the corresponding two abnormal event sequences; The abnormal event sequence with updated labels is input into the second recognition model, and the second recognition model is trained to obtain an updated second recognition model.

[0097] Optionally, the optimization module 150 is further configured to: Obtaining a first probability of a risk event output by a second recognition model of the abnormal event sequence before updating; The product of the connection degree and the first probability is taken as the second probability; An updated label corresponding to the abnormal event sequence is determined according to the second probability and a preset threshold in the second recognition model before updating.

[0098] The device 100 provided in the embodiment of the present application can execute each method in the foregoing method embodiment and realize the functions and beneficial effects of each method in the foregoing method embodiment, which will not be described in detail here.

[0099] Figure 8 A schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present disclosure is shown. Figure 8As shown, at the hardware level, the electronic device includes at least one processor, and optionally includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device may also include hardware required for other services.

[0100] The processor, network interface and memory can be interconnected through an internal bus, which can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0101] The memory stores the program. Specifically, the program may include a program code, and the program code includes at least one computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0102] At least one processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a device for locating the target user at the logical level. At least one processor executes the program stored in the memory and specifically performs: the method disclosed in the embodiment shown in the first aspect and realizes the functions and beneficial effects of each method described in the method embodiment above, which will not be repeated here.

[0103] The method disclosed in the embodiment shown in the first aspect of the present disclosure can be applied to at least one processor or implemented by at least one processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware or software instructions in at least one processor. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present disclosure can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly embodied as a hardware decoding processor for execution, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium mature in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0104] The electronic device can also execute the methods described in the foregoing method embodiments, and realize the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be repeated here.

[0105] Of course, in addition to software implementation, the electronic device disclosed in the present invention does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0106] The embodiments of the present disclosure also propose a computer-readable storage medium, which stores one or more programs. When the one or more programs are executed by at least one processor, they implement the method disclosed in the embodiment shown in the first aspect and realize the functions and beneficial effects of the various methods described in the previous method embodiments, which will not be repeated here.

[0107] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0108] Furthermore, the embodiments of the present disclosure also provide a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the following process is implemented: the method disclosed in the embodiment shown in the first aspect and the functions and beneficial effects of the various methods described in the previous method embodiments are implemented, which will not be repeated here.

[0109] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the various processes of the method disclosed in the embodiment shown in the first aspect and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0110] In short, the above is only a preferred embodiment of the present disclosure and does not limit the protection scope of the present disclosure. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

[0111] The systems, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0112] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0113] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0114] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A method for training a risk identification model, characterized in that: The method comprises: Acquire multiple event sequences in a financial transaction process, wherein the event sequences include event type, event occurrence time, and event subject; According to a preset risk business rule, a risk tag is marked for a risk event sequence in the multiple event sequences to obtain a risk event sequence; Inputting the unlabeled event sequence into the autoencoder neural network to be trained for training to obtain a trained autoencoder neural network, and adding a fully connected layer to the trained autoencoder neural network to form a first recognition model, wherein the unlabeled event sequence is other event sequences among the multiple event sequences except the risk event sequence; The risk event sequence is input into the first recognition model for training to obtain a trained second recognition model.

2. The method according to claim 1, characterized in that The preset risk business rules include a first risk business rule and a second risk business rule, the risk level of the event sequence corresponding to the first risk business rule is higher than the risk level of the event sequence corresponding to the second risk business rule, and the step of labeling the risk event sequence in the multiple event sequences with a risk tag according to the preset risk business rule to obtain the risk event sequence includes: Marking the event sequence that meets the first risk business rule with a high-risk label; Marking the event sequence that meets the second risk business rule with a common risk label; Other event sequences in the event sequence except those marked with the high-risk label and the ordinary risk label are used as the unlabeled event sequence.

3. The method according to claim 1, characterized in that The step of inputting the unlabeled event sequence into the autoencoder neural network to be trained to obtain a trained autoencoder neural network includes: The unlabeled event sequence is input into the autoencoder neural network to be trained, with the goal of minimizing the reconstruction error of the autoencoder neural network to be trained, and the parameters of the autoencoder neural network to be trained are iteratively optimized through a back propagation algorithm until a preset number of iterations is reached or the reconstruction error is less than a preset threshold, thereby obtaining the trained autoencoder neural network.

4. The method according to claim 1, characterized in that: The method further comprises: In response to a user's labeling operation on the unlabeled event sequence or a label update operation on the risk event sequence, an updated labeled event sequence is obtained; The updated labeled event sequence is input into the second recognition model, and the second recognition model is trained to obtain an updated second recognition model.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Taking the event sequence whose output result during the training process of the first recognition model is different from the corresponding label as an abnormal event sequence set; Filter the abnormal event sequence with the highest label frequency from the abnormal event sequence set to obtain an abnormal event sequence subset; Calculating the degree of connection between each of the abnormal event sequences in the abnormal event sequence subset, and updating the corresponding label according to at least one of the connection degrees corresponding to the abnormal event sequences, wherein the connection degree represents the temporal correlation and attribute similarity between the corresponding two abnormal event sequences; The abnormal event sequence with updated labels is input into the second recognition model, and the second recognition model is trained to obtain an updated second recognition model.

6. The method according to claim 5, characterized in that The connection degree is the product of the time association degree and the attribute similarity, and the updating of the corresponding label according to at least one of the connection degrees corresponding to the abnormal event sequence includes: Obtaining a first probability of a risk event output by a second recognition model of the abnormal event sequence before updating; The product of the connection degree and the first probability is taken as the second probability; An updated label corresponding to the abnormal event sequence is determined according to the second probability and a preset threshold in the second recognition model before updating.

7. The method according to claim 5, characterized in that The time correlation is determined by the following formula: Among them, the is the time correlation, is the time difference between two event sequences, is the time difference between the latest event sequence and the earliest event sequence in the abnormal event sequence subset, is the time difference between the later event sequence and the earliest event sequence in the two event sequences, The preset adjustment parameters.

8. A training device for a risk identification model, characterized in that: The device comprises: An acquisition module, used to acquire multiple event sequences in a financial transaction process, wherein the event sequence includes event type, event occurrence time, and event subject; A labeling module, used for labeling risk labels for risk event sequences in the multiple event sequences according to preset risk business rules to obtain risk event sequences; A first training module is used to input an unlabeled event sequence into an autoencoder neural network to be trained to obtain a trained autoencoder neural network, and add a fully connected layer to the trained autoencoder neural network to form a first recognition model, wherein the unlabeled event sequence is other event sequences among the multiple event sequences except the risk event sequence; The second training module is used to input the risk event sequence into the first recognition model for training to obtain a trained second recognition model.

9. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the training method for the transaction risk identification model as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the training method of the transaction risk identification model according to any one of claims 1 to 7 is implemented.

Images